Legal

Privacy Policy

Last updated: June 2026. Onyx Dynamics Ltd, Republic of Mauritius.

Privacy Policy

Last updated: June 2026 · Onyx Dynamics Ltd, Republic of Mauritius

1. Introduction

At Energy-Data.io, a brand of Onyx Dynamics Ltd, we are committed to handling your personal data with care and transparency. This Privacy Policy explains what data we collect, why we collect it, how we use it, and who we share it with when you visit our website or use our services. By using our website or platform, you acknowledge that you have read and understood this policy.

2. Data Controller

Onyx Dynamics Ltd

The Trademark, 550 La Promenade

2nd Floor, Offices 201 & 202

Telfair, 80829 Moka

Republic of Mauritius

Email: info@energy-data.io

3. Data We Collect

When you visit the website we collect standard server log data: pages visited, date and time, browser type, operating system, and IP address (anonymized where possible).

When you create an account or purchase a plan we collect registration and checkout information including name, email, company, and billing details. Billing is handled by Paddle.com Market Ltd as Merchant of Record.

When you use the platform we collect data about how you use the Service, including files you upload, queries you run, dashboards you create, and interactions with AI-assisted features. This data is stored in your isolated workspace.

When you contact us we collect the information you provide to respond to your inquiry.

4. How We Use Your Data

Provide, operate, and maintain the Service
Process subscriptions and manage billing
Respond to support inquiries
Send account-related notifications
Send marketing communications if you have subscribed (unsubscribe at any time)
Analyze usage in aggregate and anonymized form to improve the Service
Fulfill legal and contractual obligations

5. Your Workspace and Data Storage

Each account on the Agentic platform is linked to an isolated database instance hosted via Supabase, Inc. on Amazon Web Services infrastructure in the European region. Your workspace data is logically separated from other users. You own your data and can delete it at any time through the platform.

6. AI Processing and Model Providers

The Service uses AI models including third-party providers. When you interact with AI-assisted features, your inputs and relevant workspace context may be transmitted to model providers to generate responses.

We have opted out of allowing your data to be used to train third-party AI models where contractually available. Do not enter passwords, API secrets, or other sensitive credentials in chat prompts.

7. API and MCP Connector Data

When you use the Energy-Data.io REST API or MCP (Model Context Protocol) connectors, we process additional data to authenticate requests, meter API credits, and deliver degree-day weather results.

OAuth connections (for example Anthropic Claude, OpenAI ChatGPT, or other hosted MCP clients) issue access and refresh tokens bound to your account. We store OAuth client registrations, authorization codes, refresh tokens, and consent records required to operate the authorization server.

Each API or MCP tool call records usage metadata in api_usage_events, including timestamp, tool or endpoint name, request parameters needed for billing (such as date range and method), credit cost, and success or error status. We do not store full conversation transcripts from third-party AI clients.

Degree-day results are fetched from our weather data pipeline. Location coordinates or postal codes you supply in tool parameters are used solely to retrieve weather data for your request.

API keys created in the developer portal are stored as salted hashes. Only key prefixes are shown after creation.

For MCP connector documentation see /mcp/. For technical API details see /api-documentation/.

MCP server: mcp.energy-data.io
OAuth issuer: app.energy-data.io
Scopes: degree_days (fetch data), usage_read (view credit usage)

8. Data Security

We use SSL/TLS encryption for data in transit. Workspace and API infrastructure uses encryption at rest. We implement access controls, authentication, and monitoring. In the event of a breach affecting your personal data, we will notify you and relevant authorities as required by law.

9. Cookies

We use essential cookies for session management and authentication, performance cookies to understand site usage, functionality cookies for preferences, and marketing cookies with your consent. You can change cookie preferences through our cookie settings or browser controls.

10. Third-Party Services

We use third-party providers including Paddle (payments), Supabase and AWS (hosting), Anthropic (AI models), Klaviyo and Brevo (email), Google Analytics and Ads, Microsoft Dynamics 365 and Bookings, Trustpilot, and LinkedIn. Each provider processes data under their own privacy policies.

When you connect an MCP client such as Anthropic Claude or OpenAI ChatGPT, that platform may process tool parameters and responses on your behalf as part of your session with them. We do not control their data practices; see their privacy policies for details.

11. Newsletter

If you subscribe to our newsletter we send updates about the Service. You can unsubscribe at any time via the link in any email or by contacting us.

12. Your Rights

Contact info@energy-data.io to exercise these rights.

Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your data, subject to legal obligations
Restrict processing in certain circumstances
Data portability in a structured format
Object to processing based on legitimate interests
Withdraw consent where processing is based on consent

13. Data Retention

Terminated accounts: workspace data retained 30 days, then deleted
Paid accounts downgraded to free: data retained up to 12 months after last payment
Inactive free accounts: data may be deleted after 30 days notice
API usage events: retained for billing and audit for the active credit period and reasonable thereafter
Billing records: retained as required by accounting and tax law

14. Data Transfers

Your data may be processed outside Mauritius, including the United States and European Union, by providers listed in Section 10.

15. Children

The Service is intended for business use and is not directed at individuals under 18. We do not knowingly collect data from minors.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the date at the top and notify you of significant changes by email or in-app notice.